feat: bootstrap repo — enforcement layer + #685 perf capture

Enforcement (check-rules/hooks/shellcheck) per ADOPTING pattern; perf/ SoR
from the #685 session (memcensus, pg role-caps SQL, applied sysctl, planned
daemon.json); questions-v1 (API token + dockerd window asks).

Meat + verification: https://projects.knownelement.com/issues/727#note-3913

STATUS.md

@@ -0,0 +1,21 @@
+> Operations Status lives on Discourse: [t/297](https://community.turnsys.com/t/297).
+> This file is a sparse git-tracked scratch index — Redmine has the history.
+
+# STATUS
+
+Last updated: 2026-09-02
+
+| ticket | state | item |
+|--------|-------|------|
+| #727   | 🔄    | repo bootstrap + perf script capture |
+| #685   | ⏳    | founder soak — evening storm window is the real test; caps stay until tymeslot ships a POOL_SIZE env |
+| #626   | ⏳    | Cloudron proxying (Grocy multi-user + HA general access) |
+| #710   | ⏳    | custom Ubuntu 24.04 base image for Cloudron hosts |
+| #723   | ⏳    | linkwarden save-to function |
+| #724   | ⏳    | CTO/CCO/BOD/COS Linux accounts/invites |
+
+## Inbox (founder action items)
+
+- Cloudron API token (asks in #685/#727): create in the panel → material value
+  to `~/.creds/cloudron.env` — unblocks API-first access + future AWX modules.
+- docker daemon.json bounce window (see README) — ticket it when scheduled.